EUVD-2026-22348
GHSA-qwjq-mqc6-9q3h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7.2.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
SQL injection in Fortinet FortiDDoS-F 7.2.1-7.2.2 allows authenticated remote attackers to execute unauthorized code or commands with high impact to confidentiality, integrity, and availability. The vulnerability resides in the web management interface and requires low attack complexity with no user interaction. No public exploit identified at time of analysis, with EPSS data not yet available for this recently disclosed CVE.
Technical ContextAI
FortiDDoS-F is Fortinet's dedicated DDoS mitigation appliance providing inline protection against volumetric and application-layer attacks. This vulnerability affects versions 7.2.1 through 7.2.2 and stems from CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The flaw indicates inadequate input validation or parameterization in SQL query construction within the management interface, allowing malicious SQL syntax injection. The CPE identifier cpe:2.3:a:fortinet:fortiddos-f:*:*:*:*:*:*:*:* confirms this affects the FortiDDoS-F application platform. SQL injection vulnerabilities in network security appliances are particularly critical as these devices typically operate with elevated database privileges and contain sensitive configuration data, attack signatures, and traffic analysis records.
RemediationAI
Organizations should immediately upgrade affected FortiDDoS-F appliances to a patched version as specified in Fortinet's security advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-119. The advisory reference FG-IR-26-119 indicates Fortinet has acknowledged and addressed this vulnerability through their standard PSIRT process. Until patching is complete, implement compensating controls including restricting management interface access to trusted IP addresses only via firewall rules or access control lists, enforcing strong authentication with multi-factor authentication where possible, monitoring administrative access logs for suspicious SQL syntax patterns in request parameters, and ensuring all administrative accounts follow least-privilege principles. Review and rotate credentials for all administrative accounts as a precautionary measure. Disable remote management access if operationally feasible until patches are applied. Consult the official Fortinet advisory for specific upgrade paths and any additional mitigation guidance for your deployment model.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today